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ABSTRACT 

In this paper, we present a direct fault tolerant control (DFTC) technique, where by 
“direct” we mean that no explicit fault identification is used. The technique will be 
presented for the attitude controller (autopilot) for a reusable launch vehicle (RLV), 
although in principle it can be applied to many other applications. Any partial or complete 
failure of control actuators and effectors will be inferred from saturation ot one or more 
commanded control signals generated by the controller. The _ saturation causes ‘ reducho 
the effective gain, or bandwidth of the feedback loop, which can be modeled as an increase 
instngular permeation in the loop. In order to maintain stability, the bandwidth of the 
nominal (reduced-order) system will be reduced proportionally according to the singular 
perturbation theory. The presented DFTC technique automatically handles momentary 
saturations and integrator windup caused by excessive disturbances, guidance command or 
dispersions under normal vehicle conditions. For multi-input, multi-output (MIMO) systems 
with redundant control effectors, such as the RLV attitude control system, an algorithm is 
presented for determining the direction of bandwidth cutback using the method of 
minimum-time optimal control with constrained control m order to maintain the best 
performance thaUs possible with the reduced control authority. Other bandwidth cutback 
Lie such as one that preserves the commanded direction of the bandwidth or favors a 
preferred direction when the commanded direction cannot be achieved, is also discussed. I 
[his extended abstract, a simplistic example is proved to demonstrate the idea. In the final 
paper, test results on the high fidelity 6-DOF X-33 model with severe d.spers.ons will be 

presented. 


1. Introduction 

Tvoical fault tolerant control techniques include integration supervisor, failure detection and 
identification followed by control reconfiguration. The paper [Bab96] discusses an approach 
“d to in.egra.ing L s ,«s such .ha. .he faui. .olerance requ.^n* were me for 
stages of assembly Some of the key integration issues are examined and the role of ana ysi 
tools is described [Bab%]. A flexible flight control architecture that 

cost and high reliability of the launch vehicle is presented in the paper IET90J. It provides des g 
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workarounds to optimize the system to meet its m.ssion requirements. In the paper 
design of a fuzzy logic supervisor for a reconf.gurable flight control law is described The 
objective of the supervisor is to maintain the original performance of the aircraft after effector 
fadure^by adjusting the gains of the existing control law. The paper lBar92] demonstrates an 
innovative fault-tolerant approach that captures the knowledge of functional decomposition, 
failure modes and effects analysis and configuration management in a dynamic prototyping 
p r wcc Tn rhe paper fWSK+001 an open software architecture, called the Open Control Plat orm 
(<£ technologies and resources is described. The specific dnvmg 
application is Supporting autonomous control of vertical take-off and landing (VTOL) 

uninhabited autonomous vehicles (UAVs). rpi 

Extensive research has been done in fault detection and identification. In the paper L BL&ffl 
a stable scheme for bias estimation in the case of attitude tracking is presented. The scheme 
based on the design of nonlinear observers for unknown bias identification and state estimation. 
The properties of the proposed scheme are evaluated through simulations using a generic 

an overview of fau,. diesis and condo, — " 
complex systems such as those required in the aerospace industry. The paper [ BGM^l de_ 
a systematic computer-aided design procedure for Failure Detection and Identification (FDI) 

Adaptive Reconfigurable Control (ARC) for aerospace applications. 

In the paper ULOOl a geometric approach is developed for the model matching pro 
specific to the reconfigurable control situation where failed control surfaces have to be ^emula e 
by differential thrust. In the paper [WG W 99] Quantitative Feedback Theory (QFT) > ^ as ^ 
successfully to enhance the robust stability and tracking performance of the pitch flight control 
system for a remote pilotless vehicle (RPV), within its full flight envelope. 

Y Autonomous unmanned systems require provision for fault detection and recovery. Multip y 
redundant schemes typically used in aerospace applications are prohibitively expensive and 
"naf r„Tu.ion y for unmanned systems where low cos, and small size a-n.ma K Aurom 
Flight Sciences is developing alternative low-cost, fault-tolerant control (FTC) capabilities 
incorporating failure detection and isolation, and control reconfiguration algorithms into aircraft 
flight P contro1 systems. In the paper [VM96] a 'monitoring observer’, or failure detection filter 
predicts the future aircraft state based on prior control inputs and measurements and mte^rete 
discrepancies between the output of the two systems. The fault-tolerant contro (FTC) detect 
and isolates the onset of a sensor or actuator failure in real-time, and automatically reconfigures 

the control laws to maintain full control authority [ VM96 ], 

A technique for the design of flight control systems that can accommodate a set of actuator 

failures is presented in the paper I HSC001 . As employed herein, an actuator failure is defined as 
[ changl in the parametric model of the actuator that can adversely affect actuator perfonnance 
The Technique is based on the formulation of a fixed feedback topology that ensures at leas 
Itabimy in the presence of the failures in the set. Application to a single-, npu^,ngle-o», put 
design using a simplified model of the longitudinal dynamics of the NASA High-Ang e-of- 
Atta^k Research Vehicle is discussed IHSC001 . The principles underlying the fault-tolerant 

controller are also presented in the paper [ HC97 ] . . . f .. 

The paper 1 BDR951 describes how fault tolerance has been addressed in the (tesign o 

Attitude an^ Articulation Control Subsystem for the Saturn-bound Cassini spacecraft. The paper 
describes a fault-tolerant system for attitude and orbit contro o f Insat 
In the paper IPTD92 1 the Redundant Inertial Flight Control Assembly (RIF ) • P 
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which is a system that offers a practical implementation of fault tolerant avionics through 

redundancy..^ ^ reconfiguration capabnilies applicable lo reusable launch ' 

nrnnnsed in fSWM+011. The goal is to detect effector failure using on-line parameter identificati , 
aZt the^ inn^^control system via a prescribed gain schedule to recover some maneuvering 
capability, and employ on-line trajectory generation if necessary. This approach is presented v ia a case 
study involving the X-34 RLV. The on-line trajectory generation scheme builds upon the authors pn 
work on off-line trajectory design. A new supervisory scheme for robust on-line failure detect 
and isolation and adaptive reconfigurable control is presented m [BLMOJJ- The approach is 
demonstrated through simulated carrier landings of an F/A-18C/D aircraft in the presence 
battle damage and critical subsystem failures. To circumvent difficulties ^ 

incorrect assumption of relatively fast effector dynamics, a technique is presented in IM o 
compensating individual effector dynamics while respecting actuator constraints. In L&emj, a 
method for pre-designing controllers for a switching control scheme for systems undergoing 
actuator failure is described. The approach accommodates actuators frozen at non-zero positions 

using a steady-state disturbance rejection technique. 

Control reconfiguration features must be included into the guidance and conlrol system 
design for the 2 nd generation RLV to accommodate actuator failures. It is noted that all the fault 
tolerant control techniques reviewed rely on some fault identification procedure, which in 
general 1 reqmre large" computational resource while providing limited fault recognition 
capabilities" The separate control reconfiguration procedures will introduce additional delay 

resoonding to faults, which m&y reduce survivability. f 

P In this 8 paper, we propose a direct fault tolerant control (DFTC) algorithm that does no 
depend on explicit fault identification. Control effector failures will be inferred from degradation 
of control authority as indicated by control command saturation, and controller gam wi 
adjusted based on L singular perturbation principle to ensure .ability ,n the P-e"ce of a, nr. 
This approach requires minimal computational resources while promising fast response to 
undetected 5 failures as well as large dispersions. The presented DFTC technique automatically 
handles momentary saturations and integrator windup caused by excessive disturbances 
guidance commands dispersions under normal vehicle conditions. For multi-input, multi-output 
8 MIMO) systems with redundant control effectors, such as the RLV attitude control system a " 
algorithm is presented for determining the direction of bandwidth cutback using the method o 
minimum-time optimal control with constrained control in order to maintain the best 
performance that is possible with the reduced control authority. Other bandwidth cutback logi 
such as one that preserves the commanded direction of the bandwidth or favors a preferred 
direction when the commanded direction cannot be achieved, is also discussed. In this extended 
abstract, a simplistic example is proved to demonstrate the idea. In the final paper, test results on 
the high fidelity 6-DOF X-33 model with severe dispersions will be presented. 


2. Singular Perturbation Approach to DFTC 


From the vehicle health and integrity point of view, failures of control act nators or e^ctore, 
hereafter indiscriminately called effectors, are different from saturation of the fully functional 
effectors in the sense that an actuator failure results in permanent loss of use of the failed 
effector whereas actuator saturation typically results in temporary loss of use of the actuator 
However, both type of events have the same effects on the vehicle, that is the reduction 

control authority. 
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From this point of view, a stuck aero-surface is equivalent to a constant wind gust with 
control saturation, and a degraded aero-surface or RCS effector is equivalent to a fully functional 
effector subject to a disturbance torque. The controller cannot tell nor does it care whether 
control command saturation is due to wind gust or a stuck effector, because it only computes the 
required torque, based on the vehicle’s mass property and the bandwidth (in a loose sense 
nonlinear systems) of the feedback loop, to eliminate the tracking error. A truly adaptive 
controller should be able to do this even if the vehicle has lost significant control authority ue 
control effector failure. It is up to the combination of the control allocation and the cont 

effectors to realize the required torque. 

The loss of control authority will eventually result in an increase in the tracking error, whic 
will in turn cause the proportional and integral (PI) controller to produce excessive control 
command, such as the torque command to the control allocation unit or the body rat * 
to the body rate inner loop. Thus, controller adaptation can be triggered when the control 
command exceeds a threshold that can be easily determined in real time. This is the ph' o^p y 
of the direct fault tolerant control, as no explicit fault identification is used for the adaptation. Of 
course any knowledge of the specific failure will be valuable for accurately determining 
threshold of available^ control authority that triggers the adaptation, for the reconfiguration of the 

control allocation law, and for abort decisions. . , . . . . . , th . 

Neglecting the flexible modes, the closed-loop vehicle dynamic behavior is governed by he 
rigid body equations of motion under applied forces and moments that are determined by the 
controller^ solely by the vehicle’s mass properties and the (nonlinear) loop bandwidth in the sense 
of^gnaTattenuation and time lag in propagating through the loop Thus, as long as the vehicle 
mass property is not altered significantly in an unknown fashion due to the ^>'^^^^18 
highly^ unhkely, the only change to the attitude control algorithm is to account for the bandwidt 
change due to momentary or permanent control command saturation. This can be formulated a, 

S '"^C(^s^^r U Ui^sbgul^y e pe^rbe<^'cl S osed-loop nonHnear backing -or dynamics modeied by 

X — f (t , X, v) 

ez = sat(A(f)z + B(t)u) 
v = C(t)z. 

vv = F(t)w + G(t)x 
u -M(t)w + N(t)x 

where sat(-) is the saturation function, x is the tracking error state variable of the “nominal” 
system z is the state variable of the singular perturbation which may be an inner loop, or the 
dynamics of the control actuators or effectors, and w is the state vanaWe of a linear dynamic 
feedback controller for the nominal system. For instance, F(t) = 0 , G(t) -/, M(t)-K, (0 , an 
A f(t) = KJt) represent a PI controller where w is the error integral, and the time varying 
integral gain K,{t) is applied at the output of the integrator. Note that for time varying gains, 
this is different from the case where the integral gain K,(t) is applied at the input of the 
integrator, for which = l and G(t) = K,(t). A block diagram of this system is given in 

assume that by design the null equilibriums x = 0 and y = 0 for the boundary layer 
equation £ y = sat( A(t)y) are exponentially stable. The parameter £ >0 is a sufficiently small 
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constant whereby Me represents the separation of time scale of the fast dynamics y(t) and the 
slow dynamics x(t ) . By a well-known result in the singular perturbation theory [ Kha961 , there 
exists an £* > 0 such that e < £ ensures the exponential stability of the overall system. 



Figure 1 . Singularly Perturbed System Model 

The parameter e can be approximated by the ratio between the outer loop (input, state and 
time dependent) bandwidth (O nma and the inner loop bandwidth a> n inner as 

, outer 

€- 

^n. inner 

The saturation function can be approximated by a linear function with a variable gain K e(t (a) 
dependent on some indicator a for the “depth of saturation” as follows 

sat(x) ~ K eff (a)x 

where K eff -^0 as the saturation deepens. With this approximation, the singular perturbation 
equation for z can be approximated by 
£ cfl (a)z = A(t)z + B(t)u 

where the effective time scale separation parameter £ el f (a) is given by 

£«, («)= £ • 

K el( (a) 

Thus, as saturation deepens, the £ eft (a) will continue to grow until the required time scale 
separation for the overall stability is violated. On the other hand, if the outer loop bandwidth can 
be reduced in real time by a factor of K eff (a) , the overall stability will be maintained, albeit that 
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the tracking performance will be sacrificed. Note that this degraded tracking performance 
amounts to a reduction in control authority for the next outer loop, such as the gu'dance oop. 
Thus the same principle can be used to scale back the guidance loop bandwidth until it is 
determined that the crippled vehicle can no longer accomplish the original mission go 
maintain safe flight. At that time, an abort decision can be made. . „ , 

In order to adjust the bandwidth, a meaningful metric of the “depth of saturation needs i to , b 
defined. An instantaneous metric a(t) can be defined as the ratio of the commanded control 
versus the available control, such as the commanded torque and the available torque as 
determined by the control allocation unit, or the commanded aero-surface deflection angle vers 
the (nominal) limit of the aero-surface deflection angle. However, such instantaneous metric 
does noTtake into account of the “duty cycle” of the saturation over a period^ A classical 
approach to this problem is the describing function for periodic saturations. For aperiodic 
saturations, we propose to use the integration of a nonlinear function K(a(t)) over a specifie 

moving time interval 


f K{a{r))dr 
Jf-r 


A- it (0 t 

where *(■) is an appropriate Class-K function such that «r<0) = 0 , «r(l) = I . *<„) S a Vo < I , and 
K(a) > a Va > I . A convenient choice for such a Al ) is K(a) = a' for some r > I . 

3. Time- Varying Bandwidth DFTC 

The proposed fault tolerant attitude controller takes advantage of the time-varying PD- 
eigenvalue assignment stabilization technique used in the trajectory linearization controller 
(TLC) 1 ZBHQ0 1 and I ZFH+Oll and the recently developed time varying sliding mode contro 
rrV-SM C) [SZD021. The time varying bandwidth synthesis formula is given in 1 — — J an 
S in Son. design case srudies of a TV-SMC and/or a TLC an, rude controller for an 

RLV will be presented to demonstrate the DFTC technique. 

4. An Optimal Policy for MIMO DFTC Bandwidth Adjustment 

Although performance degradation is inevitable when control commands saturate, for MIMO 
systems with redundant control effectors more control authority can be allocated to the more 
demanding output channels to achieve the best performance possible under the degraded contro 
authority S This ? can be accomplished by developing an optimal policy for determining 
direction of the available control authority, and consequently determine the direction of the P 
of saturation a and the effective gain K e „(a) for the DFTC bandwidth adjustment. For fl g 
control systems, this can be formulated as a problem of minimum-time optimal control with 

C ° n Taking* die' control torque saturation for example, suppose at each control time instant the 
control allocation unit can provide the (state dependent) maximum attainable moments set 5 . 
When the commanded torque r c (t ) = [L c (r) M L (t) N c (t) ] T falls outside 5 , the objective is to 

find an attainable torque r.(r) = [ A(0 M .(*> that minimiZCS the ^ T ^ " 
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takes to bring the current tracking error x(t 0 ) = x 0 to a desirable state x(T) - x r . Then the 
instantaneous depth of saturation is given by 

[mo MM Ml] 7 , 

“ L., (r ) M„(f) N,(t)_ 

The optimal attainable torque can be found by solving the standard minimum-time optimal 
control problem for the nominal system, that is, minimizing the minimum-time performance 

index 

J 'fo +T 

1 dt 

1 1 . 

subject to (see Equation ( 1 )) 
x = fit, x, v) 

v(t,x) = -C{t)A~' (t)B{t)u(t,x) = T(t,x)e S 
x{t () ) = x t] , x(T) = x T (t () ) 

where the desirable final state x T (t () ) is chosen at t„ based on the criticality of the tracking error 

in each channel, which will influence the direction of the allocated torque. 

It is noted that the minimum time T min serves as an indicator for the performance 
degradation. When T mm exceeds a certain threshold, the guidance loop will have to reduce the 
bandwidth as well, or abort may be necessary. It is also noted that the allocated torque is 
different from the applied torque that is actually generated by the control effectors. The 
difference between them is the torque loop tracking error to be handled by the dynamic contro 
allocation algorithm. The coordination of the guidance, attitude control and control allocation 
loops and abort decisions will be made by a supervisory controller called autocommander. 

5. An Illustrative Example 


Consider the attitude kinematics and rotational dynamics associated with the equations of motion 
of a rigid body 

y(t) = R( y(t)Mt) 
h(t) = -t o(t)xh(t) + x(t) 
h(t) = J (*)«>(0 

in which y = [<t> 0 yf is the vector of Euler angles, co= [p q rf is the vector of body axis 

angular velocities, A is the associated angular momentum, % = [ L M N f is the vector of 

applied torques referenced to the body frame, and J is the inertia matrix. 

With the goal of explicitly characterizing the effect that torque saturation has on effective 
gain and deriving a heuristic gain adaptation policy, we begin with simple proportional inner an 
outer loop control laws given by 
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X r (f) = K mnrr J{t) (<o,(f)-co(f)) 
c o l (t) = K„ uler R-'W)) (Y,(0-Y(0) 


where AT and K are scalar gain parameters and Y,« represents commanded Euler angles 
generatedTy the guidance law. Here, following the singular perturbationphilo^y, the idea ,s 
To design a “fast" inner loop with respect the outer loop dynam.cs so that .f oXr) = co,.U) , the 
outer loop control law achieves approximate dynamic inversion with linear outer loop dynamics 
whose bandwidth is determined by the gain parameter K , mter . This assumption then requires 


£ = 


K„ 


** fhetfficultytne encounters when tmplementing this control strategy is that it may no, be 
possible to achieve the commanded torque demanded by the inner loof , centre ,1 aw. To explore 
this issue further we assume that corresponding to an attainable moment ’ 

allocation strategy is such tha, the achteved torque is in the same direct, on as the commanded 

torque. That is, 

x(t) = a(T ( .(r)) t,.(0 

where 


o(x, ) : 


f=l i/t r e5 
I < 1 if x t . t S 


in such a way that the achieved torque equals the commanded torque if the latter lies within the 
attainable moment set and the achieved torque lies on the boundary of the attainable moment set 

in the direction of the commanded torque otherwise. . , t - n 

The inner loop with torque saturation can be analyzed using the Lyapunov function 

v hmer (h)=mt- 

Since h is always orthogonal to the cross product term cox/j , the derivative of V iimi , r (h) along 
inner loop trajectories is 

V mn „ r (h) = 0(x < ) K hwer h r {h -h) 

where h = J(t) co, . The similarity between this result and that corresponding to a first-order 
linear system suggests that an effective measure of inner loop gain (bandwidth) is the original 
gain parameter L, -led by the saturation factor a(x.). Scaling the outer loop gam 
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parameter K by the same factor would maintain the required value of e, however the 
modified control laws may not be well-posed since an algebraic loop is introduced. This 
problem can be circumvented by filtering the saturation factor which leads to the control aw 


CO, Xt) = G f (t) K„ R-'W)) (Y t .(0-Y(0) 


in which o.(r) is the filtered scale factor and K f is a filter parameter. 

Nonlinear simulations were conducted using guidance command and time-varying inertia 

profiles representing the X-33 during ascent. Gain parameters were selected as K - 1 

K , =5. This value of K, mler yields reasonable tracking performance in the ideal case of an 
instantaneous inner loop without saturation, as depicted in Fig. 2. The value of K yields a 
sufficiently fast inner loop without torque saturation since the resulting outer loop attitu e 
traTkiS ^ performance, depicted in Fig. 3, is nearly identical to the idea. case. Based on the 
corresponding commanded/achieved torque response in Fig. 4, saturation limits of 5 
were subsequently imposed independently in each body axis channel, for which the associated 

attainable moment set is a three-dimensional hypercube The etf ®” °g f ^“[hnchteved^raue 
adaotation is evident from the attitude tracking response shown in Fig. 5 and he achieved torque 
response shown in Fig 6. The modified control law using the filtered scale factor yields the 
attitude tracking response shown in Fig. 7 and the achieved torque response shown in Fig. 8 
Here we see that tracking performance suffers somewhat during the initial portion of the ascen 
in which the torques required to closely track the attitude command greatly exceed the imposed 
limits (recall Fig 4) and the outer loop gain is significantly reduced based on the gain adapta i 
Xv described above. However, once the commanded torques recede to within limits the 
outer loop gain is restored to its nominal value and nominal tracking performance is recovered. 


6. Summary and Conclusions 


In this section, 
disadvantages of 
technique will be 


ie main results of this paper will be summarized. The advantages and 
ie DFTC technique will be discussed, and further research tor improving 


proposed. 
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Figure 2. Attitude tracking response with instantaneous inner loop 






Figure 3. Attitude tracking response without torque saturation 
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Figure 4. Achieved torque response without torque saturation 
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Figure 5. Attitude tracking response with torque saturation but without gain adaptation 
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Figure 7. Attitude tracking response with torque saturation and gain adaptation 






Figure 8. 
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Achieved torque response with torque saturation and gain adaptation 
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